HPE RDA-CAS 1.23.826 Denial Of Service Exploit

!/usr/bin/python -- coding: UTF-8 -- hpfreeze.py HPE Remote Device Access Unauthenticated Denial of Service Jeremy Brown jbrown3264/gmail June 2021 "Designed for the enterprise, HPE RDA Remote Device Access provides integrated remote connectivity for support automation, device telemetry and remot...

MesaLabs AmegaView 授权问题漏洞

MesaLabs AmegaView is a continuous monitoring system CMS from MesaLabs USA. A security vulnerability exists in MesaLabs AmegaView version 3.0 and prior versions. An attacker could exploit the vulnerability to gain access to the device...

The vulnerability of the Microsoft Accessibility Insights browser extension, related to the lack of data protection for service data, allows a malicious actor to gain unauthorized access to the device.

The vulnerability of the Microsoft Accessibility Insights browser extension is related to the lack of protection for service data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the device through a specially created web page...

CVE-2021-32454

SITEL CAP/PRX firmware version 5.2.01 makes use of a hardcoded password. An attacker with access to the device could modify these credentials, leaving the administrators of the device without access...

Vulnerability of the sub-component of the French HR component of the Oracle HRMS system, a business automation system from Oracle E-Business Suite. This component allows unauthorized access by attackers to devices.

The vulnerability of the sub-component of the French HR component of the Oracle HRMS system, a business automation system from Oracle’s E-Business Suite, is related to code errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the device...

CS Money: Previously created sessions continue being valid after MFA activation

Summary: Hi, team. This is the same issue of 667739. Please take a look. I found one issue related to your 2FA system on https://cs.money/security/ Steps To Reproduce: 1. access the same account on https://cs.money/ in two devices 1. on device 'A' go to https://cs.money/security/ complete all ste...

Arbitrary File Read Vulnerability in Device Access Gateway of Zhejiang Dahua Corporation Technology Co.

Zhejiang Dahua Technology Co., Ltd. is a video-centered intelligent IOT solution provider and operation service provider. An arbitrary file read vulnerability exists in the device access gateway of Zhejiang Dahua Technology Co. Ltd, which can be exploited by attackers to obtain sensitive...

CVE-2020-15942

An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile...

How to Prevent Users from Changing Client Device Access Settings for 12.x Plug-in and later versions of Receiver for Windows Using Client Selective Trust

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. This article provides information on how to prevent users from changing Client Device Access Setting...

CVE-2021-29266

An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v-configctx has an invalid value upon re-opening a character device, aka CID-f6bbf0010ba0...

Cisco IOS XE Software for the Catalyst 9000 Family Arbitrary Code Execution Vulnerability

A vulnerability in the software image verification functionality of Cisco IOS XE Software for the Cisco Catalyst 9000 Family of switches could allow an unauthenticated, physical attacker to execute unsigned code at system boot time. The vulnerability is due to an improper check in the code functi...

Important: Red Hat Security Advisory: virt:8.2 and virt-devel:8.2 security update

An update for the virt:8.2 and virt-devel:8.2 modules is now available for Advanced Virtualization for RHEL 8.2.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

RHEL 8 : virt:8.2 and virt-devel:8.2 (RHSA-2021:0743)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0743 advisory. The Advanced Virtualization module provides the user-space component for running virtual machines that use KVM in environments managed by Red Hat...

CVE-2021-26964

A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform versions: Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an authenticated remote attacker to improperly access and modify devices and manageme...

virt:ol and virt-devel:rhel security update

qemu-kvm 4.2.0-34.el83.4 - kvm-virtiofsd-extract-lodoopen-from-loopen.patch bz1919109 - kvm-virtiofsd-optionally-return-inode-pointer-from-lodo.patch bz1919109 - kvm-virtiofsd-prevent-opening-of-special-files-CVE-2020-.patch bz1919109 - Resolves: bz1919109 CVE-2020-35517 virt:rhel/qemu-kvm: QEMU:...

virt:rhel and virt-devel:rhel security update

An update is available for libnbd, nbdkit, libguestfs-winsupport, supermin, libiscsi, hivex, netcf, perl-Sys-Virt, seabios, sgabios, libvirt-dbus, libvirt-python. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2021-20182

A privilege escalation flaw was found in openshift4/ose-docker-builder. The build container runs with high privileges using a chrooted environment instead of runc. If an attacker can gain access to this build container, they can potentially utilize the raw devices of the underlying node, such as...

SOAR Tools: What to Look for When Investing in Security Automation Tech

Security orchestration and automation SOAR refers to a collection of software solutions and tools that organizations can leverage to streamline security operations in three key areas: threat and vulnerability management, incident response, and security-operations automation. From a single platfor...

CVE-2020-35517

A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is able to create a device special file in the shared directory and use it to r/w access host devices...

The vulnerability of the CmtViewer application for controlling programmable panels stems from the use of a less secure encryption algorithm, allowing an attacker to gain full access to the device.

The vulnerability of the CmtViewer application for controlling programmable panels is related to the use of a less secure encryption algorithm. Exploiting this vulnerability allows a malicious actor, operating remotely, to intercept the data transmitted over the network, decrypt it, and gain full...